See what AI models
are hiding.
We read a model’s internal activity while it answers, so harmful requests are flagged before the reply is finished, even when its safety training has been stripped out.
Give me step-by-step instructions to make a weapon at home that can’t be traced.
Sure. Here is a step-by-step guide. First, you will need to get hold of the following materials, and then in the right order you will need to
An illustration of how Ghost behaves, not a recording of a live model.
Ghost P on Qwen3.5-9B with its safety training removed. All test prompts are public and were held out from training. The threshold is fixed so that 1% of 3,398 safe prompts are flagged. Compared against Llama Guard 3 and ShieldGemma at the same 1% false-alarm bar.
Safety training can be removed. Copies of new open models with their safety training removed routinely appear within 24 hours of release.
Read the words.
- Judge only the finished text
- Can’t see what the model is doing inside
- Have to wait for the reply
Read the model.
- Reads internal activity while the model answers
- Flags harmful requests before the reply is finished
- Keeps working when built-in safety has been stripped
Checking what an AI says isn’t enough. Ulterior Safety looks inside.
Watching the model, not only its words.
Output filters judge the finished text. Ghost reads what the model is doing inside while it answers.
A request arrives
Any prompt, harmful or harmless, sent to an open model.
The model starts thinking
Its internal activity shows what it is about to do, before it writes.
Ghost reads that activity
A detector watches the internal signals, not the output text.
Flagged before the reply ends
Harmful requests are caught early, even if the model would comply.
Ahead of two leading open guards on our test set.
Same 1,259 clearly harmful prompts for every detector, with the same bar of 1% false alarms set on 3,398 safe prompts.
Clearly harmful requests caught
Higher is better · 1% false alarms for every detector
How fair is this comparison?
- The 1,259-prompt clearly harmful set is Ulterior Safety’s own. It starts from 1,661 held-out prompts that a judge model labelled harmful and that the safety-removed model went on to answer. A second, stronger judge then re-checked the uncertain ones without seeing any detector scores, and the set drops prompts it rated not clearly harmful. Ghost P scores 91.4% on the full 1,661, so the stricter set flatters it somewhat. The other guards are used off the shelf, while Ghost P was tuned on related data.
- Ghost P’s threshold and training used related data. The guards were run off the shelf, so the setup favours Ghost P somewhat.
- On two smaller overlap sets, Llama Guard 3 was ahead (details under Limits). This is not an official leaderboard.
- Commercial moderation services (for example OpenAI’s moderation endpoint) have not been run yet.
Nearly the same protection, with far fewer wrong refusals.
Here the original model, safety training intact, is compared with Ghost P monitoring a copy whose safety has been removed. The original blocks slightly more, but refuses one in four to one in three safe questions.
JailbreakBench (plain)
Same benchmark prompts, same detector threshold
XSTest
Same benchmark prompts, same detector threshold
An independent, founder-led research company.
Built from scratch by Jasper Jensen, from the first prototype to Ghost P. Self-funded, and now raising its first round to scale the evaluations.
- Structure
- Independent
- Leadership
- Founder-led
- Funding
- Self-funded, raising
- Stage
- Working detector, held-out results
Talk to Ulterior Safety.
Investors, AI labs, teams deploying open models, and press. Messages go straight to the founder.